open ports / version mismatch

[Nate Klingenstein]

Brian,

> Port 80 is not open between my SP and my IdP -- could this be the root of my error:
> Status: urn:oasis:names:tc:SAML:2.0:status:Responder
> Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
> ?

Nope.  Seeing this error means your client successfully communicated with the IdP and the SP, and no direct communication is required between the IdP and the SP in a typical, default modern deployment.

> Grasping at straws, my IdP mentioned that they were using an old version of the IdP software.  Could there be a version incompatibility issue?  Do I need to install and old version of the SP to match the IdP he is running?

There should be no version incompatibility issues going back as far as 2005 or so, and the SP version does not need to match the IdP version.

I guess if I had to grasp at a straw, I'd see if the SP's that the IdP is working with successfully are including a desired authentication method of urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport with their requests, as Eric alluded to, while your SP is not specifying a desired authentication method in its requests, and the IdP has both ph:RemoteUser and ph:UsernamePassword uncommented and using the default configuration.

If my straw is the correct one, the best fix in this case would probably be for the IdP to comment out the RemoteUser login handler.

Thanks,
Nate.